qakbot | 95ee22aab54b2ce172df7826595e0d63365945cd4fd27178eab3cfa08fbe6c70

General

Target
95ee22aab54b2ce172df7826595e0d63365945cd4fd27178eab3cfa08fbe6c70.exe
Size 838KB
Sample201113-jmrb6btswe
SHA256 95ee22aab54b2ce172df7826595e0d63365945cd4fd27178eab3cfa08fbe6c70
MD5 d801b77c4ccd58af9f84aa35226213a3
SHA1 b7f2dcc3f61c6e62df6e39cfb6a036326c868b5f
SHA512 618d01b58e810b23fece3ea7a84bc3946c410e84c4d19c2b3b2c8e90fc3568d55d22a2ec1a5c58da8b7838d7160877798e623e4fcb5449321a35dded5a8008e9
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	95ee22aab54b2ce172df7826595e0d63365945cd4fd27178eab3cfa08fbe6c70.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	95ee22aab54b2ce172df7826595e0d63365945cd4fd27178eab3cfa08fbe6c70.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	95ee22aab54b2ce172df7826595e0d63365945cd4fd27178eab3cfa08fbe6c70.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	95ee22aab54b2ce172df7826595e0d63365945cd4fd27178eab3cfa08fbe6c70.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	95ee22aab54b2ce172df7826595e0d63365945cd4fd27178eab3cfa08fbe6c70.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	95ee22aab54b2ce172df7826595e0d63365945cd4fd27178eab3cfa08fbe6c70.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
680	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4800	95ee22aab54b2ce172df7826595e0d63365945cd4fd27178eab3cfa08fbe6c70.exe
4800	95ee22aab54b2ce172df7826595e0d63365945cd4fd27178eab3cfa08fbe6c70.exe
4308	95ee22aab54b2ce172df7826595e0d63365945cd4fd27178eab3cfa08fbe6c70.exe
4308	95ee22aab54b2ce172df7826595e0d63365945cd4fd27178eab3cfa08fbe6c70.exe
4308	95ee22aab54b2ce172df7826595e0d63365945cd4fd27178eab3cfa08fbe6c70.exe
4308	95ee22aab54b2ce172df7826595e0d63365945cd4fd27178eab3cfa08fbe6c70.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 4308	4800	95ee22aab54b2ce172df7826595e0d63365945cd4fd27178eab3cfa08fbe6c70.exe	78
PID 4800 wrote to memory of 4308	4800	95ee22aab54b2ce172df7826595e0d63365945cd4fd27178eab3cfa08fbe6c70.exe	78
PID 4800 wrote to memory of 4308	4800	95ee22aab54b2ce172df7826595e0d63365945cd4fd27178eab3cfa08fbe6c70.exe	78
PID 4800 wrote to memory of 3284	4800	95ee22aab54b2ce172df7826595e0d63365945cd4fd27178eab3cfa08fbe6c70.exe	79
PID 4800 wrote to memory of 3284	4800	95ee22aab54b2ce172df7826595e0d63365945cd4fd27178eab3cfa08fbe6c70.exe	79
PID 4800 wrote to memory of 3284	4800	95ee22aab54b2ce172df7826595e0d63365945cd4fd27178eab3cfa08fbe6c70.exe	79
PID 3284 wrote to memory of 680	3284	cmd.exe	81
PID 3284 wrote to memory of 680	3284	cmd.exe	81
PID 3284 wrote to memory of 680	3284	cmd.exe	81